Do Son 
Google Plans to Remove Client-Side XSLT
Google plans to deprecate client-side XSLT support in Chromium browsers. As a result, the Remote Desktop Web Access pages on Windows Server may stop rendering properly.
The portal relies on the browser to perform XSLT transformations. Therefore, IT administrators should prepare an alternative before the browser update arrives.
Why RD Web Access Is Affected
RD Web Access is the web front end of Remote Desktop Services. Through a browser, users sign in and reach the remote desktops and apps they are authorized to use.
The classic portal uses XSLT on the client side. It converts the XML that the server returns into a web interface.
What Users Will See
Once a browser disables XSLT, the page may show an error saying RD Web Access cannot be displayed. In addition, users will not see their remote resources.
Microsoft’s support documentation lists Windows Server 2016, 2019, 2022, and 2025 as affected. The problem appears when policy turns the XSLT feature off.
Why Google Is Dropping XSLT
Google says XSLT appears in only about 0.02% of page loads. Pages that use XSLT processing instructions account for less than 0.001%.
Moreover, Chromium relies on libxslt, an aging C and C++ codebase. It carries memory safety risks such as buffer overflows. Consequently, the cost of maintenance and the security risk no longer match its tiny usage.
The Deprecation Timeline
According to the Chrome XSLT deprecation plan, support ends with Chrome 158, which ships on November 17.
Enterprise policy users and origin trial participants can keep XSLT for a while longer. However, Chrome 176 will remove those enterprise policies for good on August 17, 2027. That gives companies about 10 months to migrate.
Microsoft’s Interim Options
Microsoft offers three workarounds for administrators:
- Re-enable XSLT by policy: Set the XSLTEnabled option for Chromium browsers to 1 through Group Policy or the registry.
- Deploy the HTML5 web client: Users can start sessions directly in the browser or download RDP files.
- Use IE mode in Microsoft Edge: Add the RD Web Access address to the Enterprise Mode site list.
The policy route only buys time until Chrome 176. Thus, the HTML5 web client is the safer long-term path.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
